Attention Shoppers: Fruit and Vegetable Prices Are Rising

Grocery shoppers may soon need more green in their wallets to afford their next salad.

The cost of fresh produce is poised to jump in the coming months as a three-year drought in California shows few signs of abating, according to an Arizona State University study set to be released soon.

The study found a head of lettuce could increase in price as much as 62 cents to $2.44; avocado prices could rise 35 cents to $1.60 each; and tomatoes could cost 45 cents more at $2.84 per pound. (The run-up in produce prices is in line with other projections showing that overall food cost gains are expected to accelerate this year.)

The latest projections were compiled by Timothy Richards, an agribusiness professor at ASU’s W.P. Carey School of Business. He studied the drought’s effect on farmland and consumer purchasing trends to determine the eight fresh fruits and vegetables likely to see the largest price increases this spring and summer.

And the price increases may already be happening. Grocery prices rose by 0.5% for the second-straight month in March, according to the Labor Department’s consumer-price index, released Tuesday. It was the largest two-month gain in the food-at-home category since 2011. Fruit and vegetable prices rose 0.9% last month, after a 1.1% gain in February. Meat and dairy prices are also increasing. Meanwhile, overall consumer prices rose just 0.2% last month, as broader inflation in the economy remains tepid.

Reuters

California is the largest domestic producer of each of the products Mr. Richards identified, ranging from grapes to peppers. And in the case of avocados, it’s the only state with a significant crop.

The drought has wiped out between 10% and 20% of California crops for the eight items, but the size of the expected price increases varies widely. Lettuce prices could jump as much as 34% and avocado prices could rise 28%, the largest projected increases.

“People are the least price-sensitive when it comes to those items, and they’re willing to pay what it takes to get them,” Mr. Richards said. “It’s hard to make a salad without lettuce.”

In basic economic terms, the drought reduces supply, which puts upward pressure on prices. But how high the price can rise is determined by consumers’ willingness to pay more against their ability to find a substitute.

Packaged salads, for example, would increase in price by only 13%, even though many of the ingredients in them are projected to increase in cost by a greater percentage. That’s because consumers view premade salads as a “luxury” good and would readily switch to lower-cost alternative if the price gets too high, Mr. Richards said. They could chop the lettuce themselves or buy frozen vegetables.

The impact could spread beyond the produce aisle. Items such as lettuce, tomatoes and peppers are commonly used in deli sandwiches and salsas, among other products.  The drought could also cause those items to cost more.

Still, the run-up in prices is likely to be somewhat temporary, Mr. Richards said. When prices increase, farmers outside of California, including foreign suppliers, will be incentivized to ship more crops to the U.S. That will in turn put downward pressure on costs.

But with water-supply problems expected to persist for years, California farmers will have some difficult choices to make, he said. They’ll need to determine which crops should receive the limited amount of available water, and which should be allowed to fall away.

“We could be looking at future,” he said, “where California is no longer bread basket for the country.”

 

Fuel Cells Power Up: Three Surprising Places Where Hydrogen Energy is Working

The concept is tantalizing: Use abundant hydrogen to fuel vehicles and power plants, producing nothing but water and heat as a byproduct. The advent of hydrogen fuel cells would help provide the energy the world needs, while slashing greenhouse gas emissions and curbing our dependence on oil.

If that notion seems too good to be true, that’s because it has been. Despite a flurry of investment in fuel cells over the past two decades, the vision articulated by former President George W. Bush of an America leading the world in producing “pollution-free” vehicles that run on hydrogen has seemingly evaporated into thin air. But the fuel cell is far from dead—indeed, it is gaining a commercial foothold in some niches, evidenced most recently by news that megaretailer Walmart is expanding its use of fuel cells to power forklifts at its stores.

Such implementations of fuel cells, which use hydrogen and oxygen to produce energy via an electrochemical reaction, are small but growing exponentially. According to a U.S. Department of Energy (DOE) report released last October, annual global shipments of fuel cell systems increased sixfold between 2008 and 2012. And at least one major analyst forecasts that the market for some fuel cells will grow from $1.4 billion to $40 billion by 2022.

Still, industry players speak with an awareness of the gap between the lofty hopes that have been pinned to fuel cells and the market reality. “Fuel cells can’t do everything for everyone,” said Chip Bottone, president and CEO of the Connecticut-based power company FuelCell Energy, “but we are getting to a point where we could play a very significant role.”

Lower Emissions, but Higher Costs

Fuel cells come in a wide variety of types and applications, from stationary cells that produce energy for both primary and backup power to systems used in vehicles like cars and forklifts. But so far, the cost of producing fuel cell technologies remains a barrier to widespread adoption, as does a lack of fueling infrastructure for hydrogen cars.

And hydrogen, despite being abundant and clean when employed in a fuel cell, must be harvested. Nearly all the hydrogen produced in the United States comes from natural gas in a process called steam reforming. Other potential feedstocks include coal or biomass. It is also possible to use emissions-free nuclear or renewable power to harvest hydrogen by electrolysis—running an electric current through water to break the bond between hydrogen and oxygen.

Even when fossil fuel is used as a feedstock to produce hydrogen, fuel cells can offer significant emissions benefits. Research by the the U.S. Department of Energy’s National Renewable Energy Laboratory (NREL) suggests that in a “well to wheels” analysis, hydrogen cars fed by natural gas can cut greenhouse gas emissions by more than a third compared to conventional gasoline cars, and by more than half if the hydrogen is produced from biomass. Emissions are zero once the fuel cell is operating.

Here are three areas where fuel cells are making inroads, plus another one that shows promise:

Forklifts

In February, Plug Power announced a deal to supply 1,738 hydrogen-powered forklifts and associated infrastructure to Walmart. Although Plug had been around since 1997 and had never seen a profit—explaining why its shares sank from nearly $1,500 in 2000 to 15 cents in 2013—over the course of the next two weeks, the company’s stock nearly tripled in value.

Short-selling was a factor in the run-up, but there was no denying that 1,738 was a big number, one that confirmed a real and growing market for materials-handling equipment (MHE) powered by fuel cells. NREL research suggests the switch from lead-acid batteries makes sense: In a test of 490 units that operated for a total of 1.5 million hours, the lab found them to be reliable and capable of saving about 10 percent in costs.

“If you have a big distribution center and have several dozen forklifts running, you’ll see productivity gains using fuel cells,” said Keith Wipke, who manages fuel cell research programs for NREL. A fuel cell forklift can be refueled in a minute or two, a small fraction of the time it can take to swap out a battery. Fuel cell forklifts offer another edge, too: While the battery-powered forklifts degrade in performance as their charge winds down, fuel cell forklifts run at full power until empty.

A big chunk of the deployment over the past five years was driven by 2009 stimulus-related funds, as well as incentives that won’t last forever. NREL says that continued, long-term growth of fuel cells in the MHE sector could hinge on whether the systems that are put into use prove to be as durable as promised.

Electricity for Homes and Businesses

The world’s largest fuel cell plant, a 59-megawatt facility in South Korea that opened earlier this year, provides both power and heat to homes in Hwasung. Another fuel cell “park” is set to be built in Seoul. Those cities join several municipalities and companies that are using fuel cell power plants to provide baseload electricity for homes, data centers, fulfillment centers, and similar applications.

Government subsidies have played a key role in the approval of these projects. In the United States, for example, stationary fuel cells are aided now by incentives in a few states and by a federal tax credit of up to 30 percent that expires in 2017. The relatively low price of natural gas as feedstock for these plants is helping as well.

Fuel cell power plants still are not close to competing with the size and cost-effectiveness of large gas-fired power plants, but when they can overcome their most persistent obstacle—high capital costs—they can deliver significant amounts of relatively clean, continuous-baseload energy that beats grid rates in states where energy costs are high.

Chip Bottone of FuelCell Energy, which provided the systems for the South Korea plant, acknowledges that competing on price will be key for fuel cells. “We can’t be a business that needs a significant incentive,” he said. Bottone said his company could build systems with a capacity of one megawatt or more that could deliver electricity at a cost of 13 to 14 cents per kilowatt-hour. With the current incentives, he said, they can “play in the nine to ten range,” which is about the average retail going rate in the United States.

For companies such as eBay, Apple, and Macy’s, fuel cell installations can help provide power at a stable cost while boosting operational sustainability. Verizon, when it announced the installation of systems from stationary fuel cell maker ClearEdge Power at various Verizon sites in New Jersey, New York, and California, said the use of fuel cells and solar would “reduce our carbon footprint, relieve demand on the electrical grid and enhance the resiliency of our proven service continuity—even during outages.” In the United States, stationary fuel cell customers commonly include universities, hospitals, and data centers.

Apartment complexes are also proving ripe for installations, but that’s about the extent of residential fuel cell use in the United States; at such a small scale, “the economics are tough,” said Dave Anderson, vice president of product management and strategy at ClearEdge. (An appreciable amount of home use is happening in just one place: Japan. With the energy shortage and rising costs following the 2011 nuclear accident at Fukushima Daiichi, consulting firm Navigant says about 70,000 Japanese homes are using fuel cell systems to provide energy and cooling and heating.)

Backup Power for Telecom

Fuel cells are also proving their worth as backup power, a key advantage in a world of more frequent extreme weather. As this Department of Energy post notes, cell phone towers that had backup from fuel cells kept running without issue during Hurricane Sandy, allowing communication to remain open.

While stationary fuel cells do offer protection against grid failures, they actually operate continuously, Anderson notes, “with the grid as backup.” But with the Department of Energy helping spur deployments, fuel cells that can start up quickly in case of emergency have been deployed at thousands of remote telecom network towers, and Sprint recently said it would work with the DOE to put the technology to work at rooftop network sites.

Proponents of fuel cells note that, because they have fewer moving parts than diesel generators, they have lower maintenance costs and lower failure rates. They can also be controlled and monitored remotely, while producing little noise and zero emissions. That makes them the perfect backup power source, not only for telecommunications but for any site that needs uninterrupted power. The fuel cell company Ballard Power Systems argues that, though its hydrogen fuel cell backup generator system costs a few thousand dollars more than a conventional diesel-fueled system, it will pay for itself within three years and ultimately save more than $8,000. (It should be noted, however, that Ballard’s scenario assumes the availability of the 30 percent U.S. federal tax credit.)

Cars and Buses: Gaining Speed

Long after President Bush began a push to bring fuel cell cars to market, several automakers are advancing beyond the demonstration cars they began deploying a decade ago. Hyundai is now marketing a fuel cell version of its Tucson sedan, while Toyota and Honda will follow suit with their own fuel cell models next year. Meanwhile, NREL is evaluatinga number of fuel cell bus demonstrations in the United States and Canada. In its most recent analysis, a 20-bus fleet operating in Whistler, Canada, over two years saved 4,400 tons in carbon dioxide emissions; on the downside, maintenance costs for the buses were 58 percent higher than for their diesel counterparts.

A host of factors are inspiring this transition from “the stuff of science fiction to something real,” as Scott Samuelsen, director at the National Fuel Cell Research Center at the University of California Irvine, put it: Carmakers have figured out how to use less of the expensive catalyst platinum in the fuel cells; improved fuel cells can now start up quickly and operate well in cold weather that used to cause freeze-ups; range can easily hit 300 miles, thanks to storage tanks that hold more compressed hydrogen; and a fueling infrastructure is on its way in California, backed by taxpayers.

The last point is particularly important. There are now just nine public hydrogen fueling stations in all of the Golden State (compared to about 10,000 gasoline stations) and a single station—even just an island at an existing gasoline station—can cost upward of $2 million. But with the state now picking up more than half the installation costs, California expects to have 68 strategically placed stations open to the public by 2017. For the several thousand or so fuel cell cars expected to be on the road, “This will offer accessibility,” Samuelsen said. Then, “as more people choose these cars, we move into a phase of expanding capacity.”

Some, like Tesla’s Elon Musk, beg to differ. Last year, he offered a profanity-laced dismissal of fuel cells’ viability. But Samuelsen, citing the greater range and quicker refueling times that fuel cell vehicles offer, said it would be wrong to view the future of cars as a winner-take-all battle between battery electrics and fuel cells. “I see families having one of each,” he said—a small battery electric that can be charged daily at home or work for short-range city driving, and a bigger fuel cell vehicle for longer excursions, fueled periodically at a filling station just like today’s gasoline cars.

Even the most optimistic of fuel cell vehicle advocates will surely concede that, as U.S. Energy Secretary Ernest Monizsaid in January, “there is still the need for substantial cost reduction” in order for such cars to truly be viable on the market. Yet there’s also a firm belief that the cars will eventually make it. NREL’s Wipke said, “Even in the depths of the recession, the car companies, by and large, didn’t give up. That showed me that this wasn’t greenwashing. They really see this as the future.”

Article by Pete Danko for National Geographic.

 

6 Signs Your Retirement Plan is in Trouble

After the 2008 economic meltdown, when the stock market fell 37 percent, veteran financial advisor Curt Whipple says he met with clients from outside financial institutions who’d lost 50 to 60 percent of their portfolio in a single year.

“Almost no one foresaw what happened that year, and I doubt very much that many will foresee a collapse if it happens again,” says Whipple, a Certified Wealth Strategist, Certified Estate Planner and CEO of C. Curtis Financial Group.

“Regardless, there are eight indicators that you can focus on that will help you identify whether or not you’re taking too much risk in your portfolio and if your retirement plan is in danger.”

Whipple, who recently published “Retiree Lifeline! How to Get Government Out of Your Pocket,” (www.ccurtisfinancial.com), a retirement planning guide, reviews the six danger signs from 2008 to watch out for in 2014.

• You either looked at your accounts every day OR you wouldn’t look at them at all. In 2008, people couldn’t believe what was happening to their portfolios. They looked at their account every day – an exercise in masochism – as their advisors told them either, “just hang in there,” or reminded them that the market is a long-term investment that cyclically rises and falls. That advice led them to stop looking at their accounts, which was as bad as looking at them every day, as their advisor told them to just hold on.

• You lost more than 15 to 20 percent of your investments’ value in 2008. That indicates you had too many risky investments. It’s important to know what level of risk you’re comfortable with – generally speaking, the younger you are, the riskier you can be. However, risk is also a personal decision. Make sure you and your advisor are on the same page regarding risk tolerance. That will require your advisor taking the time to explain your investments and how they’re diversified.

• Your broker or financial advisor fails to call you regularly. You should get a call every quarter from your advisor to review and discuss your account. The only time this should not be the case is if you specifically request to be contacted less frequently.

• Your portfolio is tied mostly to Wall Street or stocks, bonds and mutual funds. If each investment you have is one or all of the above, then your investments are not truly diversified. In addition to those investments, you should consider alternative investments like Real Estate Trusts (REITS), and your accounts should feature some kind of guarantee.

• You depend on your bond portfolio to protect you in hard times. We are living in a new financial era; bonds now have an inverse relationship to interest rates, which are so low now that they will invariably increase in the future. As interest rates rise, bonds will decline in value. That’s why using bonds as your only alternative to a falling market is a dangerous idea.

• You excessively worry about money. Your fear may be based in reality if you have a number of risky investments; if you really don’t understand what you are invested in; or if you don’t have a clear plan to achieve your financial objectives.

About Curt Whipple, CWS, CEP

Curt Whipple is the author of “Retiree Lifeline! How to Get Government Out of Your Pocket,” (www.ccurtisfinancial.com). A Certified Wealth Strategist (CWS) and Certified Estate Planner (CEP), he is Chief Managing Partner at the C. Curtis Financial Group, which he formed in 1986. Since then, Curtis Financial Group has counseled and advised individuals and corporations on their financial goals and decisions. Whipple is a nationally recognized speaker.

 

Microsoft Abandons Windows 8.1: Take Immediate Action Or Be Cut Off Like Windows XP

P Photo/Richa

Hit: Windows XP (2001)

Released in 2001, Windows XP proved popular enough to last a good decade. It was Microsoft’s first mass-market OS to support Windows NT, a powerful multiprocessing, multi-user OS.

Microsoft MSFT +0.43% has been on a roll lately. Office for iOS (and soon Android), free Windows licenses for small devices, universal Windows and Windows Phone apps, Siri rival Cortana, even a promise to eventually return the start menu before Windows 9. But when it comes to Windows 8, it seems the company has a permanently loaded pistol aimed squarely at its feet.

So it fits that just one week on from the launch of ‘Windows 8.1 Update 1’ (the smart upgrade mouse and keyboard users have long awaited) stupidity would strike once again.

“Windows 8.1 Update is a cumulative update to Windows 8.1,” said Microsoft Senior Product Marketing Manager Ben Hunter in an apparently innocuous blog post aimed at IT professionals. Then came the clanger: “It also becomes the new servicing baseline for Windows 8.1, so next month’s security updates (on May 13th, the next ‘Patch Tuesday’) will be dependent on Windows 8.1 Update.”

In English: Windows 8.1 will no longer receive security updates after 13 May. This is your 4 week countdown warning.

For many it is no big deal. Just update and be quick about it. But for anyone who chooses not to install every Microsoft update the moment it appears, like mainstream users or – let me think – most businesses around the world… it is another matter entirely.

So come 13 May Microsoft will issue security patches that detail flaws they are fixing and those flaws will be left unpatched for all Windows 8.1 users. A nightmare scenario. It is also the same scenario Windows XP users now face after Microsoft cut off security updates this month, a generous 13 years after its initial release. Come 13 May Windows 8.1 will be 8 months old.

An argument could be made that Microsoft is merely determined to keep all its users up to date. That argument is somewhat undermined by the fact users still on Windows 8 will keep receiving security patches until January 2016.

Furthermore Microsoft’s decision has terrible timing. It is announced against the backdrop of Heartbleed, a security bug which this month exposed user details on 17% of the world’s supposedly secure web servers. Heartbleed has hit headlines around the globe and made users paranoid about security. Microsoft could not see it coming, but in refusing to give Windows 8.1 users more time in its wake the company looks antagonistic.

It gets worse because Microsoft recognises Windows 8.1 Update 1 has problems. In a TechNet post Senior Microsoft Consultant Steve Thomas confirms there is “an issue regarding Windows 8.1 Update preventing interaction with WSUS 3.2 over SSL connections” and until it is fixed the deployment of Update 1 will be suspended to affected machines.

For affected users who have already downloaded Windows 8.1 Update 1 Thomas says “we recommend that you suspend deployment of this update in your organization until we release the update that resolves this issue.”

Yes, Microsoft faces a race against time entirely of its own making. It is a no win situation. Even if Microsoft issues a fix before 13 May every day spent is a day less for administrators to check for compatibility issues and apply Update 1 across all their Windows 8.1 machines.

And yet perhaps the most frustrating aspect to all of this is Windows 8.1 Update 1 is a great update. In fact it is arguably the best and most important update Windows 8 has received.

Amongst other things Update 1 intelligently boots users without touchscreens to the desktop by default and uses desktop apps by default, it reduces the sensitivity of hot corners, highlights newly installed apps and dramatically improves the Modern UI for keyboard and mouse users. It also cuts its install size in half (from 32GB to 16GB) on SSDs, runs faster on slower hardware and drops minimum memory requirements from 2GB to 1GB of RAM. The end result is a darn good operating system.

Cynics will quite rightly point out it is the OS which Microsoft should have released from day one, but nevertheless Windows 8 is now starting to realise the company’s lofty ambitions.

All of which has probably come too late. Love or loathe Windows 8, it has been a sales flop. It changed too much too soon, alienated large numbers of users and ever since Microsoft has fought to restore confidence. Windows 8.1 Update 1 looked to be the incarnation to do it, but in needlessly condemning Windows 8.1 to the same fate as 13 year old Windows XP it has all but confirmed its latest OS will never be remembered with the same fondness.

 

5 Common Causes of Prevalent Tax Mistakes

Whether you’ve filed for an extension on your taxes this year, or have waited until the last minute to complete paperwork, or want a better strategy for the future, chances are you could be doing a better job throughout the year to save on income taxes, says seasoned investment advisor Paul Taylor, a member of the National Ethics Bureau.

Forty-nine percent of Americans think they personally pay more than their fair share in taxes, according to 2013 Rasmussen reports.

“Come tax time, many of the other half could be doing more to legally and strategically save money,” says Taylor, an architect-turned-founder and owner of Capital Advisory Group & Tax Planners of Lake Norman and Capital Investment Advisors, Inc, (www.CapitalAdvGroup.com).

He cites mistakes that many taxpayers are liable to make now and in future years.

• Not knowing which tax deductions are available. Tax reform measures are enacted frequently by Congress, which makes it hard for U.S. taxpayers to know which deductions are currently available for maximizing savings. One of the most overlooked deductions is state and local sales taxes. Taxpayers may be able to take deductions for student-loan interest, out-of-pocket charitable contributions, moving expenses to take a first job, the child care tax credit, new points on home refinancing, health insurance premiums, home mortgage interest, tax-preparation services and contributions to a traditional IRA.

• Misunderstanding deduction value for medical expenses. The Affordable Care Act has altered the guidelines for tax-deductible medical expenses. Effective Jan. 1, 2013, the new policy increased the threshold for the itemized deduction for unreimbursed medical expenses from 7.5 percent of adjusted gross income to 10 percent of adjusted gross income for regular tax purposes. The increase is waived for individuals age 65 and older for tax years 2013 through 2016.

• Confusing when taxes must be paid on IRA and employer-sponsored retirement funds. Traditional IRAs and most employer-sponsored retirement plans are tax-deferred accounts, which mean they are typically funded with pre-tax or tax-deductible dollars. As a result, taxes are not payable until funds are withdrawn. Exceptions are the Roth IRA and the Roth 401(k) and Roth 403(b). Roth accounts are funded with after-tax dollars. That’s why qualified distributions – after age 59½ and the five-year holding requirement has been met – are free of federal income tax.

• Overlooking tax-advantaged investments. Tax-advantaged investments can include real estate partnerships, oil and gas partnerships and suitability, which refers to how appropriate an investment may or may not be to an investor. Two of the most common types of real estate partnerships, for example, are low-income housing and historic rehabilitation. The federal government grants tax credits to those who construct or rehabilitate low-income housing or who invest in the rehabilitation or preservation of historic structures.

• Uncertainty when accounting for gift taxes. The federal gift tax applies to gifts of property or money while the donor is living. The federal estate tax, on the other hand, applies to property conveyed to others, with the exception of a spouse, after a person’s death. There are several exceptions to gift taxes, including gifts of tuition or medical expenses that you pay directly to a medical or educational institution for someone else, gifts to a spouse who is a U.S. citizen, gifts to a qualified charitable organization and gifts to a political organization.

About Paul Taylor

Paul Taylor is the founder and owner of Capital Advisory Group & Tax Planners of Lake Norman and Capital Investment Advisors, Inc. Taylor, a fully licensed investment advisor, has more than 20 years of experience in the industry and is committed to providing personalized service to those he serves. Since 2007, he has been a member of the National Ethics Bureau, which acknowledges individuals who prove they are committed to upholding the highest ethical standards in their practices.

 

THE INTERNET’S TELLTALE HEARTBLEED

By Rusty Foster -

The cryptography expert Bruce Schneier, who has been writing about computer security for more than fifteen years, is not given to panic or hyperbole. So when he writes, of the “catastrophic bug” known as Heartbleed, “On the scale of 1 to 10, this is an 11,” it’s safe to conclude that the Internet has a serious problem. The bug, which was announced on Tuesday—complete with an explanatory Web site and a bleeding-heart logo—is a vulnerability in a widely used piece of encryption software called OpenSSL.

Heartbleed is as bad as it is possible for a security flaw to be. It can be easily exploited by anyone on the Internet without leaving a trace, and it can be used to obtain login names, passwords, credit-card information, and even the keys that keep our encrypted communications safe from eavesdroppers. The bug first appeared in OpenSSL code that was released in March, 2012—so the vulnerability has been open to exploitation for more than two years. The Internet-security firm Netcraft reported that up to five hundred thousand sites thought to be secure were, in fact, vulnerable—including Twitter *, Yahoo, Tumblr, and Dropbox.

When you log on to a secure Web site—your bank’s, for example—you see a green-padlock icon at the top of your browser window, which confirms that your connection is secure. In order for browsers to communicate securely with servers, there is a standard set of steps that both sides must perform to create, and to maintain, that secure connection. This protocol is called Transport Layer Security, or T.L.S., and everything that it requires from both sides of a secure connection is laid out in a document called RFC 5246, which describes something like the Platonic ideal of a secure Internet connection. Of course, RFC 5246 cannot, by itself, be used to keep your bank account safe. To do that, someone has to write software that will make your Web browser and your bank’s Web server actually follow the steps that RFC 5246 delineates.

Among programmers, cryptography is notorious for its difficulty—even a tiny mistake can render your seemingly secure code worthless—and the conventional wisdom is that, whenever possible, the implementation of cryptography should be left to the experts. Since 1998, one way that programmers have been able to avoid implementing encryption protocols themselves has been to use an open-source library called OpenSSL. A code “library” is just a set of common functions that programmers can use within their own code, rather than having to write them from scratch. If many people are all using the same library, and the code is open-source—so that anyone can check it for bugs—it should be more reliable and more secure than a code that one person or firm could create alone.

Heartbleed is a bug in OpenSSL’s implementation of a small part of the T.L.S. protocol, called the heartbeat extension. A “heartbeat,” in this context, is like the “beep… beep…” of a hospital heart monitor: a quick way to check that the other end of a secure connection is still there. One side sends the other side a small piece of data, up to sixty-five kilobytes long, along with a number indicating the size of the data that has been sent. The other side is supposed to send back the exact same piece of data to confirm that the connection is still active. Unfortunately, in OpenSSL the replying side looks at the stated size of the data rather than at the actual size, and it always sends back the amount of data that the request asked for, no matter how much was sent. This means that if the stated amount of data is more than the amount actually provided, the response contains the data that was sent plus however much additional data, drawn from the contents of the computer’s system memory, is required to match the amount requested.

Here is why this is so bad: the heartbeat response can contain up to sixty-four kilobytes of whatever data happens to be in the server’s random access memory at the moment the request arrives. There is no way to predict what that memory will contain, but system memory routinely contains login names, passwords, secure certificates, and access tokens of all kinds. System memory is temporary: it is erased when a computer is shut down, and the data it holds is written and overwritten all the time. It is generally regarded as safe to load things like cryptographic keys or unencrypted passwords into system memory—indeed, there is little a computer can usefully do without temporarily storing pieces of sensitive data in its system memory. The Heartbleed bug allows an attacker to “bleed” out random drops of this memory simply by asking for it. Heartbeat requests aren’t usually logged or monitored in any way, so an attack leaves no trace. It’s not even possible to distinguish malicious heartbeat requests from authentic requests without close analysis. So an attacker can request new pieces of system memory over and over again; it’s almost impossible for the victim to know they’ve been targeted, let alone to know what data might have been stolen.

Among the items that can be found in a server’s system memory are the keys to cryptographically secured connections and the certificates that allow servers to prove they are what they claim to be. An attacker who steals cryptographic keys could use them to decode and read encrypted data that had previously been intercepted; an attacker who steals certificates could use them to mimic a secure site and to intercept communications. In other words, your browser could be tricked into thinking that it’s connected securely to your bank and instead be connected to an intermediary that can read all the data flowing back and forth.

In the worst-case scenario, criminal enterprises, intelligence agencies, and state-sponsored hackers have known about Heartbleed for more than two years, and have used it to systematically access almost everyone’s encrypted data. If this is true, then anyone who does anything on the Internet has likely been affected by the bug.

But, before you panic, it is worth remembering that, at this point, we don’t know how close we are to the worst-case scenario. It is possible, though improbable, that the security researchers who exposed this flaw were, in fact, the first people to find it, which would mean that it has only been known about, and exploited, for a few days. (It was found, independently, by a team of security researchers at Codenomicon and Neel Mehta, of Google Security.) At the same time the bug was announced, a new, secure version of OpenSSL was released, and updating most of the affected servers is a straightforward task. Major services like Google and Yahoo have already patched the vulnerability. Engineers did not need to stay up all night in a mad scramble to make repairs, but, as one system administrator told me, the nature of the bug made this something more than a routine update. “It’s an update, a configuration change, and a notification to your users that there’s no way to know if their data was stolen or not,” he said. To be safe, identity certificates for servers and users must be revoked and then reissued. The fix, in other words, is both urgent and tedious, which is the worst kind of job for a programmer or system administrator.

As a user, what can you do to protect yourself? Not very much, unfortunately. The standard advice is to change your passwords, but if a service is still vulnerable then changing your password just makes it more likely that it will be the one sitting in a leaked chunk of system memory. It is also not easy to determine whether a particular service you use is still vulnerable. If a provider suggests that you change your password, it should be done immediately; otherwise, it may be better to wait a few days. If you have the option to enable two-factor security, which requires more than just a password, you should do so on every service where it’s available.

How did such a catastrophic bug remain undetected for two years? OpenSSL, which is used to secure as many as two-thirds of all encrypted Internet connections, is a volunteer project. It is overseen by four people: one works for the open-source software company Red Hat, one works for Google, and two are consultants. There is nobody whose full-time job it is to work on OpenSSL.

The project’s code is more than fifteen years old, and it has a reputation for being dense, as well as difficult to maintain and to improve. Since the bug was revealed, other programmers have had harsh criticisms for what they regard as a mistake that could easily have been avoided. Theo de Raadt, the project leader for an open-source operating system called OpenBSD, put it bluntly in a message to a mailing list: “OpenSSL is not developed by a responsible team.” The portion of the code where the bug was found is written in a programming language called C, which was first developed, at Bell Labs, between 1969 and 1973. C is a finicky and old-fashioned language that puts great demands on programmers to manage the use of system memory. No modern language would let this sort of memory leakage take place, because newer languages automatically manage memory use.

Unlike a rusting highway bridge, digital infrastructure does not betray the effects of age. And, unlike roads and bridges, large portions of the software infrastructure of the Internet are built and maintained by volunteers, who get little reward when their code works well but are blamed, and sometimes savagely derided, when it fails. To some degree, this is beginning to change: venture-capital firms have made substantial investments in code-infrastructure projects, like GitHub and the Node Package Manager. But money and support still tend to flow to the newest and sexiest projects, while boring but essential elements like OpenSSL limp along as volunteer efforts. It’s easy to take open-source software for granted, and to forget that the Internet we use every day depends in part on the freely donated work of thousands of programmers. If open-source software is at the heart of the Internet, then we might need to examine it from time to time to make sure it’s not bleeding.

 

3 Tips for Practicing Mindfulness in a Multitasking Workplace

Google, eBay, Intel and General Mills offer classes on it. So do Harvard Business School, Ross School of Business and Claremont Graduate University, among other campuses. Mindfulness is not just a corporate trend, but a proven method for success.

Mindfulness – being focused and fully present in the here and now – is good for individuals and good for a business’s bottom line.

How can people practice it in a workplace where multitasking is the norm, and concerns for future profits can add to workplace stress?

“Even if a company doesn’t make it part of the culture, employees and managers can substitute their multitasking habits with mindfulness in order to reduce stress and increase productivity,” says Dr. Romie Mushtaq, www.BrainBodyBeauty.com, a neurologist with expertise in Mind-Body medicine and Mindful Living.

“The result that you and your colleagues will notice is that you’re sharper, more efficient and more creative.”

Dr. Romie says the physiological benefits of clearing away distractions and living in the moment have been documented in many scientific and medical studies.

“Practicing mindfulness, whether it’s simply taking deep breaths, or actually meditating or doing yoga, has been shown to alter the structure and function of the brain, which is what allows us to learn, acquire new abilities, and improve memory,” she says. “Advances in neuroimaging techniques have taught us how these mindfulness-based techniques affect neuroplasticity.

“Multitasking, on the other hand, depresses the brain’s memory and analytical functions, and it reduces blood flow to the part of the right temporal lobe, which contributes to our creative thinking. In today’s marketplace, creativity is key for innovation, sustainability and leadership.

Romie offers these tips for practicing mindfulness in a multitasking business:

•  Focus on a single task for an allotted amount of time. You might say, “For 15 minutes, I’m going to read through my emails, and then for one hour, I’m going to make my phone calls,” Dr. Romie says.

If your job comes with constant interruptions that demand your attention, take several deep breaths and then prioritize them. Resist the urge to answer the phone every time it rings — unless it’s your boss. If someone asks you to drop what you’re doing to help with a problem, it’s OK to tell them, “I’ll be finished with what I’m doing in 10 minutes, then I’m all yours.”

•  When you get “stuck” in a task, change your physical environment to stimulate your senses. Sometimes we bounce from one task to another because we just don’t have the words to begin writing that strategic plan, or we’re staring at a problem and have no ideas for solutions.

“That’s the time to get up, take a walk outside and look at the flowers and the birds – change what you’re seeing,” Dr. Romie says. “Or turn on some relaxing music that makes you feel happy.”

Offering your senses pleasant and different stimulation rewires your brain for relaxation, and reduces the effects of stress hormones, which helps to unfreeze your creativity center.

•  Delegate! We often have little control over the external stresses in our life, particularly on the job. How can you not multitask when five people want five different things from you at the same time?

“Have compassion for yourself, and reach out for help,” Dr. Romie says. “If you can assign a task to somebody else who’s capable of handling it, do so. If you need to ask a colleague to help you out, ask!”

This will not only allow you to focus on the tasks that most need your attention, it will reduce your stress.

“And who knows? The colleague you’re asking for help may want to feel appreciated and part of your team!”

While it is possible to practice mindfulness in a hectic workplace, Dr. Romie says she encourages business leaders to make it part of the company culture. Stress-related illnesses are the number one cause of missed employee workdays.

“Offering mindfulness training and yoga classes or giving people time and a place to meditate is an excellent investment,” she says. “Your company’s performance will improve, you’ll see a reduction in stress-related illnesses and you’ll be a more successful businessperson.”

About Dr. Romie Mushtaq

Dr. Romie is a mind-body medicine physician and neurologist. She did her medical education and training at the Medical University of South Carolina, University of Pittsburgh Medical Center and University of Michigan, where she won numerous teaching and research awards. She brings to healing both her expertise of traditional Western medical training and Eastern modalities of mindfulness. She is currently a corporate health consultant and professional health and wellness life coach at the Center for Natural and Integrative Medicine in Orlando, Florida.  She is also an international professional speaker, addressing corporate audiences, health and wellness conferences and non-profit organizations.  Her website is www.BrainBodyBeauty.com.

 

Is Corporate Culture Part of Your Business Plan?

Whether you’re launching a new business or wondering why your existing company isn’t performing as well as predicted, longtime corporate executive Larry Katzen suggests taking a careful look at your business plan.

Did you include a section describing the workplace culture and the steps you’ll take to foster that culture?

“When you look at why businesses fail, it almost always has something to do with the culture,” says Katzen, author of, “And You Thought Accountants Were Boring – My Life Inside Arthur Andersen,” www.larrykatzen.com. “For nearly half of the startups that fail, incompetence is cited as the major cause, according to Statistic Brain. Tolerating – or not tolerating — incompetence is part of corporate culture.”

Katzen, a former managing partner at one of the world’s top five accounting firms, said his experience taught him a great deal about what kind of culture results in successful businesses. It was sadly ironic, he says, that Arthur Andersen, which held integrity chief among its values, was wrongly convicted of fabricated accusations related to the Enron scandal. The Supreme Court eventually exonerated Arthur Andersen, but the damage was already done.

“Today’s business leaders cannot leave culture to chance,” Katzen says. “They must decide what values and beliefs will form the foundation of their company, and they must ensure those values are integrated every day through example, communication, policy and incentives.”

He lists four cultural values and behaviors your company must have to be successful:

•  Integrity – from the top down. From the executive level to part-time support staff, each individual must adhere to a code of values and ethics that’s based on doing the right thing, Katzen says. “It’s absolutely essential that you and your managers make decisions based on honesty and fair play. When appropriate, take the time to explain to employees the reasoning behind big decisions, to reinforce that they’re made in accordance with ethical considerations.” Have a consistent, well-publicized policy for dealing with integrity breaches among employees, and a zero tolerance policy for breaches among management. Managers and executives who don’t adhere to company values will sabotage the culture.

•  A positive perspective at the executive level. The business leaders set the tone for the company, and if executives or managers have negative attitudes, especially in times of crisis, employees will, too. “You and your employees are not just doing jobs, you’re on a mission to improve people’s lives with the product or service you provide,” Katzen says. “The team that embarks on a mission with no hope of achieving that mission will not achieve it.”

•  Be a leader in the office and in the community. As a business leader, you should take an active role in working with organizations that benefit the community. Find ways to encourage employees to volunteer time as well, even if it’s a corporate project to which you allow each employee to dedicate a certain number of their payroll hours. “We’re all more gratified when we know we’re contributing something meaningful to the greater good,” Katzen says. “And remember – healthy communities grow healthy businesses.”

•  Make health and well-being a company priority.  Employees who exercise regularly, make healthy lifestyle changes and get regular checkups and vaccinations are doing you a big favor. They’ll be more productive and energetic and you’ll have less absenteeism. Make it easy for employees to schedule time for doctor visits, especially if you have a 9-to-5 office. Have health fair days, where employees can get free screenings and flu shots.  Reward trips to the gym, weight loss, smoking cessation and other healthy choices with drawings for prizes. And keep in mind, this is already a value among millennials – the teens to early 30-somethings who will soon make up half the work force. “They’ll enjoy being a part of that culture,” Katzen says.

Sometimes, Katzen says, CEOs with firmly held values conducive to an energetic, thriving workplace will naturally and unconsciously create a great corporate culture. But those who take time to think about the culture they want, spell out the details and exemplify and communicate them have a greater chance of success.

“Make it part of your business plan, because it’s as important as anything else in that plan.”

About Larry Katzen

After graduating from Drake University in 1967, Larry Katzen started working at Arthur Andersen and quickly rose through the ranks to become the Great Plains Regional Managing Partner. An honorable, hard-working man who devoted his life to Arthur Andersen, Larry was there from the company’s meteoric rise to its unjust demise. He stayed with the firm for 35 years, serving clients globally until 2002. He recounts his experiences in, “And You Thought Accountants Were Boring – My Life Inside Arthur Andersen,” (www.larrykatzen.com).

 

4 Ways the Workplace Has Become More Dangerous

Tips for Preventing & Handling Disaster
& Distress on the Job

Disgruntled employees, workplace bullies, active-shooter situations, illegal drug use, ex-spouses and dissatisfied clients – all can be found in a random sampling of the 2 million people affected by workplace violence in the United States, according to the Occupational Safety and Health Administration.

“Of course, of the millions of reported cases, there are many more that go unreported; workplace violence includes any act or threat of physical violence, harassment, intimidation, or other threatening disruptive behavior that occurs at the work site,” says Timothy Dimoff, one of the nation’s leading voices in personal and corporate security who has worked with the U.S. Army, the Pro Football Hall of Fame, corporations, universities and non-profit groups.

“From demeaning jokes to sexual innuendos to genuine fear of shots fired at work, hiring managers and their bosses need to understand these problems of human nature and know how to react. In my decades of experience with law enforcement and as a security entrepreneur, I’ve seen the evolution of workplace violence and management often do not know how to respond.”

Dimoff, founder and president of SACS Consulting & Investigative Services, Inc., (www.sacsconsulting.com), which analyzes and overhauls security for large public and private facilities, reviews today’s problems and offers a path for conflict resolution and prevention.

•  Inadequate use of hiring tools: Know who you’re hiring! “I can’t emphasize this enough; this is the age of information, yet potential employees often provide falsified or misleading details,” Dimoff says. “With so many candidates and so much information available today, employers often overlook useful tools in a hurry-up effort to maintain productivity with a premature hire.” There are many resources, including drug testing acknowledgment and consent forms; fully understanding laws including the Fair Labor Standards Act, equal employment opportunity guidelines and military leave guidelines; and simply knowing how to ask revealing questions to applicants.

•  Workplace intimidation & cyberbullying: Bullying is not exclusive to the schoolyard; it can follow adults into the workplace, and even home via email, texts and social media. “The first and best thing employers can do is prevention, and you do that by creating a positive and fair company culture,” Dimoff says. “Next, implement a zero tolerance policy for bullying; encourage employees to document and report bullying, and take those accusations seriously. Hold occasional staff meetings so that employees are taught to recognize signs of bullying and everyone is reminded of the zero tolerance policy.”

•  Gun violence: It can happen at what appear to be the most secure places in the world, and it can happen to the most innocent among us. Nidal Hasan, the U.S. Army psychiatrist turned jihadi, shot 13 fellow soldiers to death at Fort Hood, Texas. Twenty first-graders at Sandy Hook Elementary School never had the chance to become second-graders. We hear story after story about shootings in movie theaters, parking lots and neighborhoods. Train managers to recognize and attempt to de-escalate the situation, which can include talking to the potential aggressor in an empathetic, non-judgmental way. Fail that, there are situations for which heroes are necessary.

•  Violence against women: Homicide is the leading cause of death for women in the workplace, according to OSHA. Of the 4,547 fatal workplace injuries that occurred in the United States in 2010, 506 were workplace homicides. Once again, this comes down to a zero tolerance policy for bullying and sexual harassment, applicable to all workers, patients, clients, visitors, contractors, and anyone else who may come in contact with company personnel, such as an ex-spouse. A well-designed on-site security protocol can significantly reduce the risk of severe violence.

About Timothy Dimoff

Timothy Dimoff, CPP, founder and president of SACS Consulting & Investigative Services, Inc. (www.sacsconsulting.com), is considered one of the nation’s leading authorities in high-risk workplace and human resource issues, security, vulnerability assessments and crime. A former award-winning narcotics detective and SWAT Team member, Dimoff analyzes security for churches, businesses and other places where people gather, develops a customized plan for each, and implements it. He has multiple certifications, including as a Certified Protection Professional (CPP™), a designation that is recognized worldwide.

 

You Know You’re a Labradore Lover When:

 

 

 

 

• You let the new puppy sleep on your chest the first three nights after you bring her home, so she doesn’t miss her mommy so much.
• You go to sleep by 10:00, even with the Giants up by only 2 and Romo closing out the game, recording the last 3 outs (hopefully) knowing that you will never have time to watch it in the morning, so you can wake up an hour and a half earlier than you did before you got her, to let her out of her cage.
• You are actually happy to see three steaming piles of crap on your own lawn after you let her out.
• You are too tired to protest when she finds a random plastic bag on the beach to play with.
• You actively seek other dogs, even ones you do not particularly like or really feel safe around yet, for playdates to keep your puppy “active.”
• You seriously consider spending thousands of dollars on an artificial lawn that they cannot dig or tear up.
• Your trip to the laundry room now includes a 45 lb. passenger, treating the laundry bag like a tackling dummy.
• You look forward to her greetings in the morning, even when those big paws/claws sometimes leave gashes in your cheeks that take weeks to heel.
• You are damned sure after such experiences that the groomers are NOT trimming her claws nearly well enough, and vow to get a pair of clippers next time you are at the pet exSTOREtionist so you can do it yourself -  knowing that you would do a far better job.
• You are willing to pay $12 for a bag of “treats” that look remarkably similar to what we call Beef Jerky, which costs $7 for the same size bag.
• You think it’s cute when she jumps on the hand with the computer mouse in it and draws blood.
• You tear up when you think about her, and the last Lab you had for 17 years, and know how much you are going to miss this one too–when she is gone.